Skip to content

Commit

Permalink
nwf config deltas
Browse files Browse the repository at this point in the history
  • Loading branch information
Nathaniel Wesley Filardo committed Aug 3, 2017
1 parent 6c90434 commit c1ed48c
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 15 deletions.
2 changes: 1 addition & 1 deletion app/include/user_config.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ extern void luaL_assertfail(const char *file, int line, const char *message);
#define NO_INTR_CODE inline
#endif

//#define CLIENT_SSL_ENABLE
#define CLIENT_SSL_ENABLE
//#define MD2_ENABLE
#define SHA2_ENABLE

Expand Down
6 changes: 3 additions & 3 deletions app/include/user_mbedtls.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -101,8 +101,8 @@
#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
#undef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
#undef MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED

This comment has been minimized.

Sign in to view

Copy link
@marcelstoer

marcelstoer Aug 11, 2017

Not your fault but all these options overstrain the average user. Could they be properly grouped eventually so my cloud build could potentially give the user just a few more options? Of course, it'd ideally still just be TLS y/n but I understand those days are over due to lack of memory.
What would be the grouping dimension, though? Cypher type like ECDHE, RSA, etc. (what about combinations)? Or rather key length 128, 256?

This comment has been minimized.

Sign in to view

Copy link
@nwf

nwf Aug 11, 2017

Owner

Yeah, they overstrain even a mediocre developer like me; thank goodness mbedtls has sanity checking of its configuration.

Rather than offering full control over the options, maybe we should just have a few pre-arranged choices of user_mbedtls.h's:

  • "High-security, ECC-only; use this if you control both ends of all TLS connections and have a modern server"; uses 4096-bit-RSA equivalent ECCs, ECDHE for forward security, and AES in GCM with SHA2.
  • "High-security, but I need RSA, too; use this if some remote endpoint is out of your control and speaks RSA."; enables RSA and DHE, as well as the above.
  • "High-security, RSA, and please no ECC; use this if all remote endpoints speak RSA and you need to save flash space"
  • "Actually, I need 3DES-SHA1, too; use this only if you are communicating with a legacy server"; add 3DES-SHA1 symmetric operation. Implies RSA.

Some helpful directions like "This configuration is known to work/not work with $POPULAR_IOT_SERVICE" could be useful, but I am afraid I cannot provide much, as I tend to keep my server endpoints in-house.
#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED

#undef MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
Expand Down Expand Up @@ -197,7 +197,7 @@
#define MBEDTLS_DES_C
#define MBEDTLS_DHM_C
#define MBEDTLS_ECDH_C
#undef MBEDTLS_ECDSA_C
#define MBEDTLS_ECDSA_C
#undef MBEDTLS_ECJPAKE_C
#define MBEDTLS_ECP_C
#define MBEDTLS_ENTROPY_C
Expand Down
22 changes: 11 additions & 11 deletions app/include/user_modules.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,22 +26,22 @@
//#define LUA_USE_MODULES_BMP085
//#define LUA_USE_MODULES_BME280
//#define LUA_USE_MODULES_COAP
//#define LUA_USE_MODULES_CRON
//#define LUA_USE_MODULES_CRYPTO
#define LUA_USE_MODULES_DHT
#define LUA_USE_MODULES_CRON
#define LUA_USE_MODULES_CRYPTO
//#define LUA_USE_MODULES_DHT
//#define LUA_USE_MODULES_ENCODER
//#define LUA_USE_MODULES_ENDUSER_SETUP // USE_DNS in dhcpserver.h needs to be enabled for this module to work.
#define LUA_USE_MODULES_FILE
//#define LUA_USE_MODULES_GDBSTUB
#define LUA_USE_MODULES_GPIO
//#define LUA_USE_MODULES_HDC1080
//#define LUA_USE_MODULES_HMC5883L
//#define LUA_USE_MODULES_HTTP
#define LUA_USE_MODULES_HTTP
//#define LUA_USE_MODULES_HX711
#define LUA_USE_MODULES_I2C
//#define LUA_USE_MODULES_L3G4200D
//#define LUA_USE_MODULES_MCP4725
//#define LUA_USE_MODULES_MDNS
#define LUA_USE_MODULES_MDNS
#define LUA_USE_MODULES_MQTT
#define LUA_USE_MODULES_NET
#define LUA_USE_MODULES_NODE
Expand All @@ -53,14 +53,14 @@
//#define LUA_USE_MODULES_RFSWITCH
//#define LUA_USE_MODULES_ROTARY
//#define LUA_USE_MODULES_RTCFIFO
//#define LUA_USE_MODULES_RTCMEM
//#define LUA_USE_MODULES_RTCTIME
#define LUA_USE_MODULES_RTCMEM
#define LUA_USE_MODULES_RTCTIME
//#define LUA_USE_MODULES_SI7021
//#define LUA_USE_MODULES_SIGMA_DELTA
//#define LUA_USE_MODULES_SJSON
//#define LUA_USE_MODULES_SNTP
#define LUA_USE_MODULES_SJSON
#define LUA_USE_MODULES_SNTP
//#define LUA_USE_MODULES_SOMFY
#define LUA_USE_MODULES_SPI
//#define LUA_USE_MODULES_SPI
//#define LUA_USE_MODULES_STRUCT
//#define LUA_USE_MODULES_SWITEC
// #define LUA_USE_MODULES_TCS34725
Expand All @@ -74,7 +74,7 @@
#define LUA_USE_MODULES_WIFI
//#define LUA_USE_MODULES_WPS
//#define LUA_USE_MODULES_WS2801
//#define LUA_USE_MODULES_WS2812
#define LUA_USE_MODULES_WS2812
//#define LUA_USE_MODULES_XPT2046

#endif /* LUA_CROSS_COMPILER */
Expand Down

0 comments on commit c1ed48c

Please sign in to comment.